It is possible if the botnet is large enough, for example, 1000 bots, each bots make 10 connections, that will be 10,000 connections, and it still not reach the threshold to ban a IP yet.
If it happen again, you should check your netstat output see if it is true.
What can you do if it is true? You have to lower the threshold to make LSWS able to detect those IP abusing you server, it may cause some false alarm, but it better then being taken down completely.
If your server has enough memory, you can raise the limit of "Max Connections" of LSWS under server tuning tab.